Many control systems operate in response to a plurality of signals. For example, an aircraft automatic flight control system (AFCS) responds to the outputs of gyros, altimeters, accelerometers, computers, actuators, etc. in order to control the maneuvering of the aircraft. Furthermore, signals may be proportional, integrated, etc. Hereinafter, signals in the context of an AFCS are discussed, but the teachings disclosed herein are applicable to other signals.
A typical AFCS includes two major sub-systems for each control axis of the aircraft (roll, pitch, yaw, lift, speed). One sub-system, the outer-loop, typically has full authority to control the particular axis involved, but is limited in the rate at which it can exercise the authority. The other sub-system, the inner-loop, typically is fast acting, but limited in authority. Both loops operate through actuators. The cumulative effects of the inner-loop, the outer-loop, and pilot inputs control the particular axis involved.
To prevent runaway loops or actuators, presently configured monitor/shut-down systems include an electronic model which requires an independent source of information. A fault is indicated and shut down of the outer-loop trim actuator is achieved when a discrepancy exceeding a pre-set threshold is identified between the model and the actuator. However, such a system merely identifies a discrepancy and disables the trim actuator, and does not allow for continued operation should a model failure be the source of the discrepancy.
Commonly owned, copending U.S. patent application No. 490,698, filed on even date herewith, entitled "Aircraft Trim Actuator Shutdown Monitor System" discloses a system wherein opposite motion of the inner-loop and outer-loop actuators causes a shutdown when certain position and rate limits are exceeded.
Commonly owned, copending U.S. Pat. No. 4,387,432, filed on Mar. 30, 1981, entitled "Pulsed Aircraft Actuator", incorporated by reference, discloses an AFCS wherein the outer-loop commands are derived from the inner-loop limited proportional error signals. The outer-loop command is nominally in the same direction (i.e., of the same sense) as the inner-loop error signal. The outer-loop trim actuator is stepped, in response to outer-loop command pulses of a certain duration provided thereto whenever the inner-loop proportional error signal is biased off center and the integral of the inner-loop signal exceeds a threshold. Therefore no position sensor is required at the trim actuator. The outer-loop function is to keep the inner-loop authority centered. Recentering of the inner-loop is achieved by subtracting from the inner-loop signal an amount equal to the outer-loop command. The outer-loop actuator is an electro-mechanical device and malfunctions can occur within the actuator or in the circuits that provide the outer-loop command pulses to it, either of which could cause an undesirable actuator runaway (hardover). Therefore, an outer-loop monitor has been provided to detect outer-loop pulses of excessive duration. Obviously, with such a monitoring scheme the amount of time required to detect a malfunction is limited, at the lower end, by the duration of a complete pulse. The inherent delay in detecting a failure is not desirable in certain flight regimes. Furthermore, a failure that provides a series of pulses, each of which is within tolerance, will not be detected, but could cause a hardover. Because of these limitations, a hazardous situation may develop before a malfunction is declared and acted upon, such as in a pitch hardover.